Formal Verification Of Fault-Tolerant Systems